patchstack / includes / hide-login.php

hide-login.php in Patchstack – WordPress & Plugins Security 2.2.10, at includes/hide-login.php

156 lines 4.6 KB

Raw Download Zip

1	<?php
2
3	// Do not allow the file to be called directly.
4	if ( ! defined( 'ABSPATH' ) ) {
5	exit;
6	}
7
8	/**
9	* This class is used to hide the login page, if it's enabled.
10	*/
11	class P_Hide_Login extends P_Core {
12	/**
13	* Add the actions required to hide the login page.
14	*
15	* @param Patchstack $core
16	* @return void
17	*/
18	public function __construct( $core ) {
19	parent::__construct( $core );
20
21	if ( $this->get_option( 'patchstack_license_free', 0 ) == 1 ) {
22	return;
23	}
24
25	// Update the renamed login page if it's set to our hardcoded one.
26	if ( get_site_option( 'patchstack_mv_wp_login' ) == 0 && get_site_option( 'patchstack_rename_wp_login' ) == 'swlogin' ) {
27	update_site_option( 'patchstack_rename_wp_login', md5( wp_generate_password( 32, true, true ) ) );
28	}
29
30	// No need to continue if it is not enabled.
31	if ( ! get_site_option( 'patchstack_mv_wp_login' ) \|\| ! get_site_option( 'patchstack_rename_wp_login' ) ) {
32	return;
33	}
34
35	// Register the filters and actions for the functionality.
36	add_action( 'init', [ $this, 'init' ], ~PHP_INT_MAX + 1 );
37	add_action( 'wp_logout', [ $this, 'wp_logout' ] );
38	}
39
40	/**
41	* Deny access to wp-login.php if the login page rename feature is enabled.
42	*
43	* @return void
44	*/
45	public function init() {
46	// Do not block the user if they are already logged in as that would block a logout.
47	if ( is_user_logged_in() ) {
48	return;
49	}
50
51	// Determine if the user is whitelisted.
52	if ( ( stripos( $_SERVER['REQUEST_URI'], 'wp-login.php' ) !== false \|\| $GLOBALS['pagenow'] === 'wp-login.php' \|\| $_SERVER['PHP_SELF'] === '/wp-login.php' ) && ! $this->is_whitelisted() ) {
53	if ( isset( $_REQUEST['action'] ) && in_array( $_REQUEST['action'], ['confirm_admin_email', 'postpass', 'lostpassword', 'retrievepassword', 'resetpass', 'rp', 'register', 'checkemail', 'confirmaction'] ) ) {
54	return;
55	}
56
57	$this->plugin->firewall_base->display_error_page( 'login' );
58	}
59
60	// If the current page is the renamed login page we give the user access for 10 minutes to the login page.
61	if ( strpos( $_SERVER['REQUEST_URI'], get_site_option( 'patchstack_rename_wp_login' ) ) !== false ) {
62	// Whitelist the current IP address.
63	$this->whitelist_ip();
64
65	// Supported by a number of popular caching plugins.
66	if ( ! defined( 'DONOTCACHEPAGE' ) ) {
67	define( 'DONOTCACHEPAGE', true );
68	}
69
70	// No caching.
71	send_nosniff_header();
72	nocache_headers();
73
74	// User should be whitelisted now, redirect to the login page.
75	wp_safe_redirect( 'wp-login.php', 307 );
76	exit;
77	}
78	}
79
80	/**
81	* If the user is logging out, whitelist them again so they don't see a blocked page.
82	*
83	* @return void
84	*/
85	public function wp_logout() {
86	$this->whitelist_ip();
87	}
88
89	/**
90	* Determine if the IP address is whitelisted.
91	*
92	* @return boolean
93	*/
94	private function is_whitelisted() {
95	// Process the whitelist, and remove old ones.
96	$whitelist = get_site_option( 'patchstack_rename_wp_login_whitelist', [] );
97	$new_whitelist = [];
98	$allow = false;
99
100	// Only continue if there are actually any whitelist entries.
101	if ( is_array( $whitelist ) && count( $whitelist ) != 0 ){
102	$ip = $this->get_ip();
103	foreach ( $whitelist as $entry ) {
104
105	// Determine if the whitelist entry is still valid.
106	if ( ( time() - $entry[1] ) <= 600 ) {
107	array_push( $new_whitelist, $entry );
108
109	// Determine if the IP address matches.
110	if ( $ip === $entry[0] ) {
111	$allow = true;
112	}
113	}
114	}
115
116	update_site_option( 'patchstack_rename_wp_login_whitelist', $new_whitelist );
117	}
118
119	return $allow;
120	}
121
122	/**
123	* Whitelist the current IP address, or extend the time.
124	*
125	* @return void
126	*/
127	private function whitelist_ip() {
128	$whitelist = get_site_option( 'patchstack_rename_wp_login_whitelist', [] );
129	$new_whitelist = [];
130
131	// If the IP address is already whitelisted, reset the timestamp.
132	if ( is_array( $whitelist ) && count( $whitelist ) != 0 ) {
133	$ip = $this->get_ip();
134	$whitelisted = false;
135	foreach ( $whitelist as $entry ) {
136	// Determine if we should extend the whitelist time or ignore if already whitelisted.
137	if ( $ip === $entry[0] ) {
138	$new_whitelist[] = [ $ip, time() ];
139	$whitelisted = true;
140	} else {
141	$new_whitelist[] = $entry;
142	}
143	}
144
145	// Whitelist the IP address.
146	if ( ! $whitelisted ) {
147	$new_whitelist[] = [ $ip, time() ];
148	}
149
150	update_site_option( 'patchstack_rename_wp_login_whitelist', $new_whitelist );
151	} else {
152	update_site_option( 'patchstack_rename_wp_login_whitelist', [ [ $this->get_ip(), time() ] ] );
153	}
154	}
155	}
156